CVE-2026-72222

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: pin svc_xprt across the asynchronous TLS handshake callback

svc_tcp_handshake() stores the raw svc_xprt pointer in

tls_handshake_args.ta_data and submits the request through

tls_server_hello_x509(). The handshake core takes only

sock_hold(req->hr_sk); nothing references the embedding struct

svc_sock that svc_tcp_handshake_done() reaches via container_of().

Two close races leave the in-flight callback writing through a freed

svc_sock. svc_sock_free() calls tls_handshake_cancel() and discards

its return value: a false return means handshake_complete() has

already set HANDSHAKE_F_REQ_COMPLETED but hp_done() may not have

finished, yet svc_sock_free() proceeds to kfree(svsk). The

cancel-loser fall-through inside svc_tcp_handshake() itself produces

the same window: when wait_for_completion_interruptible_timeout()

returns <= 0 (timeout or signal) and tls_handshake_cancel() returns

false, the function does not drain

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References